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DETAILED ACTION 

1 . This Office action is responsive to communication filed on 09/22/08. 
Claims 1-66 are pending. Claims 1-30, 56-58, 65 and 66 have been elected, and 
have been examined below. 

Requirement for Information 

2. Applicant and the assignee of this application are required under 37 CFR 
1 .105 to provide the following information that the examiner has determined is 
reasonably necessary to the examination of this application. Applicant has 
claimed priority to several continuation-in-part applications. Due to the discovery 
of intervening references, applicant is required to submit a mark-up for all such 
continuation-in-part applications showing subject matter added. See MPEP 
704.1 1 (a). These documents are necessary for determining whether the claimed 
priority should be granted. 

Information Disclosure Statement 

3. The information disclosure statement filed 09/04/03 fails to comply with 37 
CFR 1 .98(a)(2), which requires a legible copy of each cited foreign patent 
document; each non-patent literature publication or that portion which caused it 
to be listed; and all other information or that portion which caused it to be listed. 

It has been placed in the application file, but the information referred to therein 
has not been considered. 
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Election/Restrictions 

4. Applicant's election without traverse of claims 1-30, 56-58, 65 and 66 in 
the reply filed on 09/22/08 is acknowledged. 

5. Claims 31 -55 and 59-64 are withdrawn from further consideration 
pursuant to 37 CFR 1 .142(b) as being drawn to a nonelected invention, there 
being no allowable generic or linking claim. Election was made without traverse 
in the reply filed on 09/22/08. 

Claim Rejections - 35 USC §112 

6. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

7. Claim 30 is rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

8. 35 U.S.C. 112, sixth paragraph states that a claim limitation expressed in 
means-plus-function language "shall be construed to cover the corresponding 
structure... described in the specification and equivalents thereof." "If one 
employs means plus function language in a claim, one must set forth in the 
specification an adequate disclosure showing what is meant by that language. If 
an applicant fails to set forth an adequate disclosure, the applicant has in effect 
failed to particularly point out and distinctly claim the invention as required by the 
second paragraph of section 112." In re Donaldson Co., 16 F.3d 1189, 1195, 29 
USPQ2d 1845, 1850 (Fed. Cir. 1994) (in banc). See MPEP 2181. 
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9. The CAFC "has consistently required that the structure disclosed in the 
specification be more than simply a general purpose computer or 
microprocessor". Aristocrat Techs. Australia PTY Ltd. v. Int'l Game Tech. , 521 
F.3d 1328, 1333 (Fed. Cir. 2008). Simply disclosing a computer as the structure 
designated to perform a particular function does not limit the scope of the claim 
to "the corresponding structure, material, or acts" that perform the function, as 
required by 1 12, sixth paragraph, and amounts to pure functional claiming, jd. In 
the instant application, applicant has described the "means for" as hardware, 
software, or a combination of hardware and software (Spec. para. [0101]). 

10. Claims 16 and 29 are rejected under 35 U.S.C. 112, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject 
matter which applicant regards as the invention. 

1 1 . The term "significantly" in claim 16 is a relative term which renders the 
claim indefinite. The term "significantly" is not defined by the claim, the 
specification does not provide a standard for ascertaining the requisite degree, 
and one of ordinary skill in the art would not be reasonably apprised of the scope 
of the invention. The term "significantly" renders the limitation "higher" indefinite. 

12. The term "substantially" in claim 29 is a relative term which renders the 
claim indefinite. The term "substantially" is not defined by the claim, the 
specification does not provide a standard for ascertaining the requisite degree, 
and one of ordinary skill in the art would not be reasonably apprised of the scope 
of the invention. The term "substantially" renders the limitation "higher" indefinite. 
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Claim Rejections - 35 USC § 101 

13. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

14. Claim 30 is rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

1 5. Computer programs claimed as computer listings per se, i.e., the 
descriptions or expressions of the programs, are not physical "things." They are 
neither computer components nor statutory processes, as they are not "acts" 
being performed. Such claimed computer programs do not define any structural 
and functional interrelationships between the computer program and other 
claimed elements of a computer which permit the computer program's 
functionality to be realized. In contrast, a claimed computer-readable medium 
encoded with a computer program is a computer element which defines 
structural and functional interrelationships between the computer program and 
the rest of the computer which permit the computer program's functionality to be 
realized, and is thus statutory. See Lowry, 32 F.3d at 1583-84, 32 USPQ2d at 
1035. See MPEP 2106.01. 

16. Applicant discloses that the invention may be implemented using 
hardware, software, or a combination of hardware and software (para. [0101]). 
Since the system of claim 30 comprises "means for" that may all be software, the 
invention is directed towards software per se, and not patentable. 
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Claim Rejections - 35 USC § 102 

1 7. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
1 22(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an international application filed under 
the treaty defined in section 351 (a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

18. Claims 1 , 2, 5, 1 1 , 1 2, 1 7, 22, 23, 28, 30, 56-58 are rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. Pat. No. 6,460,050 ("Pace"). 

19. Regarding claim 1 , Pace teaches a method comprising: 
receiving a plurality of e-mail messages (Fig. 2, Col. 3, lines 32-58); 
generating hash values, as generated hash values, based on one or more 

portions of the plurality of e-mail messages ('multiple hashes', Col. 4, lines 1-14); 

determining whether the generated hash values match hash values 
associated with prior e-mail messages (Col. 6, lines 1-18); and 

determining that one of the plurality of e-mail messages is a potentially 
unwanted e-mail message when one or more of the generated hash values 
associated with the one of the plurality of e-mail messages match one or more of 
the hash values associated with the prior e-mail messages (Col. 6, lines 1-18). 
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20. Regarding claim 2, Pace further teaches performing a plurality of hashes 
on a plurality of variable-sized blocks of a main text of the plurality of e-mail 
messages (Pace: 'all of the body or portions of the body', Col. 4, lines 1-14). 
Since the main texts of messages are not all the same length, the block (i.e., 
body) is variably-sized. 

21 . Regarding claim 5, Pace further teaches performing a plurality of hashes 
on a main text of the plurality of e-mail messages using a same hash function 
(Pace: 'MD5', Col. 4, lines 1-14). 

22. Regarding claim 1 1 , Pace further teaches comparing the generated hash 
values to hash values corresponding to known unwanted e-mails (Pace: Col. 6, 
lines 1-18). 

23. Regarding claim 12, Pace further teaches that known unwanted e-mails 
include at least one of e-mails containing a virus, e-mails containing a worm, and 
unsolicited commercial e-mails (Pace: 'spam', Col. 6, lines 1-18). 

24. Regarding claim 1 7, Pace further teaches taking remedial action when the 
one of the plurality of e-mail messages is a potentially unwanted e-mail message, 
the taking remedial action including at least one of: discarding the one of the 
plurality of e-mail messages, bouncing the one of the plurality of e-mail 
messages, marking the one of the plurality of e-mail messages with a warning, 
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subjecting the one of the plurality of e-mail messages to a virus or worm 
detection process, creating a notification message, and generating a suspicion 
score for the one of the plurality of e-mail messages and using the suspicion 
score to identify further processing for the one of the plurality of e-mail messages 
(Pace: 'subject line may be appended to indicate that the e-mail is "spam", Col. 5, 
lines 41-54). 

25. Regarding claim 22, Pace further teaches comparing the generated hash 
values to known legitimate mailing lists; and passing the plurality of e-mail 
messages without further examination when the generated hash values match 
one or more of the known legitimate mailing lists (Pace: 'exceptions', Col. 6, lines 
18-34). 

26. Regarding claim 23, Pace further teaches determining whether the 
plurality of e-mail messages originated from the known legitimate mailing lists 
(Pace: Col. 6, lines 18-34). 
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27. Regarding claim 28, Pace further teaches hashing a main text of the 
plurality of e-mail messages to generate a main text hash (Pace: 'all of the body 
or portions of the body', Col. 4, lines 1-14), and hashing at least one header field 
of the plurality of e-mail messages to generate at least one header hash (Pace: 
'header', Col. 4, lines 1-14). 

28. Regarding claim 30, Pace teaches a system comprising: 
means for observing a plurality of e-mails (Fig. 2, Element 20); 
means for hashing one or more portions of the plurality of e-mails to 

generate hash values, as generated hash values (Fig. 3, Element 110; Col. 4, 
lines 1-14); 

means for determining whether the generated hash values match hash 
values associated with prior e-mails (Fig. 4, Element 222; Col. 6, lines 1-18); and 

means for determining that the plurality of e-mails are potentially 
unwanted e-mails when one or more of the generated hash values match one or 
more of the hash values associated with the prior e-mails (Fig. 4, Element 222, 
Col. 6, lines 1-18). 

29. Regarding claim 56, Pace teaches a method comprising: 

receiving a plurality of e-mail messages (Fig. 2; Col. 3, lines 33-49); and 
detecting unwanted e-mail messages from the plurality of e-mail 
messages based on hashes of previously received e-mail messages ('hash of at 
least a portion of the e-mail', 'spam or not', Col. 3, lines 33-49), 
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where multiple hashes are performed on each of the plurality of e-mail 
messages ('multiple hashes', Col. 4, lines 1-14). 

30. Regarding claim 57, Pace teaches a method comprising: 
receiving an e-mail message (Fig. 2, Col. 3, lines 32-58); 

generating a plurality of hash values ('multiple hashes', Col. 4, lines 1-14), 
as generated hash values, over blocks of the received e-mail message ('all or 
some portion of the data under consideration', Col. 4, lines 1-14) the blocks 
including at least two of a main text portion, an attachment portion, and a header 
portion of the received e-mail message ('subject line', 'body', Col. 4, lines 1-14); 

determining whether the generated hash values match hash values 
associated with prior e-mail messages (Col. 6, lines 1-18); and 

determining that the received e-mail message is a potentially unwanted e- 
mail message when one or more of the generated hash values associated with 
the received e-mail message match one or more of the hash values associated 
with the prior e-mail messages (Col. 6, lines 1-18). 

31 . Regarding claim 58, Pace further teaches that the blocks are variable- 
sized blocks of the received e-mail message (Pace: 'subject line', Col. 4, lines 1- 
14). Since subject lines are not all the same length, the block (i.e., subject line) 
is variably-sized. 
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Claim Rejections - 35 USC § 103 

32. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 1 02 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

33. Claims 65 and 66 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pace, and further in view of U.S. Pub. No. 2002/0120705 
("Schiavone"), and U.S. Pub. No. 2002/0199095 ("Bandini"). 

34. Schiavone and Bandini are intervening references that qualify as prior art 
because the Office was unable to find in applicant's priority documents support 
for the claim limitations for which Schiavone and Bandini are relied upon. 

35. Regarding claim 65, Pace teaches a method comprising: 
receiving an e-mail message (Fig. 2, Col. 3, lines 32-58); 
generating a plurality of hash values, as generated hash values, over 

portions of the e-mail message ('multiple hashes', Col. 4, lines 1-14); and 
determining whether the generated hash values match hash values 
associated with prior e-mail messages (Col. 6, lines 1-18). 
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Pace fails to teach incrementally performing the step of determining; 
generating a suspicion score for the e-mail message based on the determining; 
and rejecting the e-mail message when the suspicion score of the e-mail 
message is above a threshold. 

Bandini teaches incrementally determining whether generated hash 
values match (Fig. 3); generating a suspicion score (Fig. 3, Step 68; para. 
[0023]); and rejecting the e-mail message when the suspicion score is above a 
threshold (Fig. 3, Step 70; para. [0023]). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to employ a running 
total suspicion score as taught by Bandini in order to classify messages as either 
clean, borderline, or SPAM using a weighted system. 

Pace-Bandini fails to teach generating hash values as a message is being 
received. Schiavone teaches performing hashing in real-time as the message is 
being received (para. [0026]). It would have been obvious to one of ordinary skill 
in the art at the time of applicant's invention to perform hashing in real-time as 
taught by Schiavone in order to bouncing messages in real-time. 

36. Regarding claim 66, Pace-Bandini-Schiavone teaches the invention 
substantially as claimed and described in claim 65 above, including the rejecting 
occurs before the e-mail message is completely received (Schiavone: para. 
[0026]). 
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37. Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pace. 

38. Regarding claim 3, Pace teaches the invention substantially as claimed 
and described in claim 1 above, including performing a plurality of hashes on a 
plurality of fixed-sized blocks of a subject line (Pace: 'some number of characters 
of the subject line', Col. 4, lines 1-14), but fails to teach doing so for fixed-sized 
blocks of the main text. 

In KSR Int'l. Co. v. Teleflex Inc. , the Court recognized that "if a technique 
has been used to improve one device, and a person of ordinary skill in the art 
would recognize that it would improve similar devices in the same way, using the 
technique is obvious unless its actual application is beyond his or her skill". 127 
S.Ct 1 727, 1 740 (2007). In the instant case, one of ordinary skill would 
recognize that SPAM messages are modified slightly in order to avoid exact 
matching by SPAM filters. It would have been obvious to one of ordinary skill in 
the art at the time of applicant's invention to apply the technique taught in Pace 
to fixed-sized blocks of main text in order to make it harder for SPAM senders to 
circumvent SPAM filters 

39. Claim 4 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pace as applied to claim 1 above, and further in view of U.S. Pat. No. 6,169,969 
("Cohen"). 
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40. Regarding claim 4, Pace teaches the invention substantially as claimed 
and described in claim 1 above, but fails to teach performing a plurality of hashes 
on a main text of the plurality of e-mail messages using a plurality of different 
hash functions. 

Cohen discloses employing multiple hash functions (Col. 2, lines 1-21) 
(describing Bloom). It would have been obvious to one of ordinary skill in the art 
at the time of applicant's invention to employ multiple hash functions as disclosed 
in Cohen in order to improve false alarm rates. 

41. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pace as applied to claim 1 above, and further in view of U.S. Pub. No. 
2003/0167402 ("Stolfo"), and U.S. 2002/0152399 ("Smith"). 

42. Stolfo and Smith are intervening references that qualify as prior art 
because the Office was unable to find in applicant's priority documents support 
for the claim limitations for which Stolfo and Smith are relied upon. 

43. Regarding claim 6, Pace teaches the invention substantially as claimed 
and described in claim 1 above, but fails to teach performing hashes on 
attachments. 

Stolfo teaches performing hashes on attachments ('MD5', para. [0045]). It 
would have been obvious to one of ordinary skill in the art at the time of 
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applicant's invention to perform hashes on attachments as taught by Stolfo in 
order to detect malicious attachments. 

Pace-Stolfo fails to teach attempting to decompress an attachment prior to 
hashing. Smith teaches decompressing an attachment prior to determining 
whether the attachment contains an exploit (Fig. 6; para. [0071]). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention 
to decompress an attachment prior to scanning as taught by Smith in order to 
find hidden exploits in an attachment. 

44. Claims 7, 8 and 10 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pace as applied to claim 1 above, and further in view of Stolfo. 

45. Regarding claim 7, Pace teaches the invention substantially as claimed 
and described in claim 1 above, including performing a plurality of hashes on a 
plurality of variable-sized blocks of information (Pace: Col. 4, lines 1-14), but fails 
to teach performing hashes on attachments. 

Stolfo teaches performing hashes on attachments (para. [0045]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to perform hashes on attachments as taught by Stolfo in order to detect 
malicious attachments. 

46. Regarding claim 8, Pace teaches the invention substantially as claimed 
and described in claim 1 above, including performing a plurality of hashes on a 
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plurality of fixed-sized blocks of information (Pace: Col. 4, lines 1-14), but fails to 
teach performing hashes on attachments. 

Stolfo teaches performing hashes on attachments (para. [0045]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to perform hashes on attachments as taught by Stolfo in order to detect 
malicious attachments. 

47. Regarding claim 10, Pace teaches the invention substantially as claimed 
and described in claim 1 above, but fails to teach performing hashes on 
attachments. 

Stolfo teaches performing hashes on attachments using a single hash 
function ('MD5', para. [0045]). It would have been obvious to one of ordinary skill 
in the art at the time of applicant's invention to perform hashes on attachments 
as taught by Stolfo in order to detect malicious attachments. 

48. Claim 9 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pace as applied to claim 1 above, and further in view of Stolfo and Cohen. 

49. Regarding claim 8, Pace teaches the invention substantially as claimed 
and described in claim 1 above, but fails to teach performing hashes on 
attachments. 

Stolfo teaches performing hashes on attachments (para. [0045]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's 
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invention to perform hashes on attachments as taught by Stolfo in order to detect 
malicious attachments. 

Pace-Stolfo fails to teach performing a plurality of hashes using a plurality 
of different hash functions. Cohen discloses employing multiple hash functions 
(Col. 2, lines 1-21) (describing Bloom). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to employ multiple hash 
functions as disclosed in Cohen in order to improve false alarm rates. 

50. Claims 13-15, 18 and 24-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pace as applied to claim 1 above, and further in view of 
Bandini. 

51 . Regarding claim 13, Pace teaches the invention substantially as claimed 
and described in claim 1 above, including hashing at least one of a main text and 
an attachment to generate one or more first hash values (Pace: 'all of the body or 
portions of the body', Col. 4, lines 1-14), and hashing a concatenation of fields to 
generate a second hash value (Pace: Col. 4, lines 1-14). 

Pace fails to teach first and second header fields. Bandini teaches first 
and second header fields (para. [0026]). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to hash multiple header 
fields as taught by Bandini in order to more accurately determine the likelihood 
that the message is SPAM. 
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52. Regarding claim 14, Pace-Bandini teaches the invention substantially as 
claimed and described in claim 13 above, including a From header field and a To 
header field (Bandini: para. [0026]). 

53. Regarding claim 15, Pace-Bandini teaches the invention substantially as 
claimed and described in claim 13 above, including generating suspicion counts 
(Pace: 'frequency', Col. 6, lines 1-18). 

54. Regarding claim 18, Pace teaches the invention substantially as claimed 
and described in claim 1 above, including taking remedial action when the one of 
the plurality of e-mail messages is a potentially unwanted e-mail message, the 
taking remedial action including: determining whether a newly received e-mail 
message exceeds a mail quota, identifying an earlier-received e-mail message 
with a highest suspicion score, determining whether the suspicion score of the 
newly received e-mail message is lower than the suspicion score of the earlier- 
received e-mail message when the newly received e-mail message exceeds the 
mail quota, deleting the earlier-received e-mail message when the suspicion 
score of the newly received e-mail message is lower than the suspicion score of 
the earlier-received e-mail message, and storing the newly received e-mail 
message (Pace: 'subject line may be appended to indicate that the e-mail is 
"spam", Col. 5, lines 41-54). 

Pace fails to teach generating a suspicion score for the plurality of e-mail 
messages based on a result of the determination of whether the generated hash 
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values match hash values associated with prior e-mail messages. Bandini 
teaches generating a suspicion score for the plurality of e-mail messages based 
on a result of the determination of whether the generated hash values match 
hash values associated with prior e-mail messages (Fig. 3, Step 68; para. 
[0023]). It would have been obvious to one of ordinary skill in the art at the time 
of applicant's invention to generate a suspicion score as taught by Bandini in 
order to classify messages as either clean, borderline, or SPAM. 

55. Regarding claim 24, Pace teaches the invention substantially as claimed 
and described in claim 1 above, including hashing a main text to generate a first 
hash value (Pace: 'all of the body or portions of the body', Col. 4, lines 1-14), and 
hashing header fields to generate one or more second hash values (Pace: Col. 4, 
lines 1-14). 

Pace fails to teach hashing sender-related header fields. Bandini teaches 
hashing sender-related header fields ('sender address', para. [0026]). It would 
have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to hash sender-related header fields in order to more accurately 
determine the likelihood that the message is SPAM. 

56. Regarding claim 25, Pace-Bandini teaches the invention substantially as 
claimed and described in claim 24 above, including that a sender-related header 
fields include at least one of a From header field, a Sender header field, and a 
Reply-To header field (Bandini: para. [0026]). 
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57. Regarding claim 26, Pace-Bandini teaches the invention substantially as 
claimed and described in claim 24 above, including generating suspicion counts 
(Pace: 'frequency', Col. 6, lines 1-18). 

58. Claims 16 and 27 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pace-Bandini as applied to claims 15 and 26 above, and 
further in view of U.S. Pat. No. 6,985,923 ("Bates"). 

59. Regarding claims 16 and 27, Pace-Bandini teaches the invention 
substantially as claimed and described in claims 15 and 26 above, but fails to 
teach determining that an email message is potentially unwanted when the main 
text matches a substantially higher number of emails than the header hash. In 
other words, an email is unwanted when the same message is received from 
different addresses. 

Bates teaches determining that a message is unwanted when the same 
message is received from different senders (Col. 1 , lines 22-30). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention 
to determine messages to be unwanted when the same message is received 
from different senders as taught by Bates in order to avoid duplicate messages. 

60. Claim 19 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pace as applied to claim 1 above, and further in view of Schiavone. 
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61 . Regarding claim 19, Pace teaches the invention substantially as claimed 
and described in claim 1 above, but fails to teach generating and comparing hash 
values as a message is being received. 

Schiavone teaches performing hashing in real-time as the message is 
being received (para. [0026]). It would have been obvious to one of ordinary skill 
in the art at the time of applicant's invention to perform hashing in real-time as 
taught by Schiavone in order to bouncing messages in real-time. 

62. Claims 20 and 21 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pace-Schiavone as applied to claim 19 above, and further in 
view of Bandini. 

63. Regarding claim 20, Pace-Schiavone teaches the invention substantially 
as claimed and described in claim 19, but fails to teach generating a suspicion 
score for the plurality of e-mail messages based on a result of the determination 
of whether the generated hash values match hash values associated with prior e- 
mail messages; and taking remedial action when the suspicion score of an e-mail 
message of the plurality of e-mail messages is above a threshold, the taking 
remedial action including rejecting the e-mail message. 

Bandini teaches generating a suspicion score for the plurality of e-mail 
messages based on a result of the determination of whether the generated hash 
values match hash values associated with prior e-mail messages (Fig. 3; para. 
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[0023]); and taking remedial action when the suspicion score of an e-mail 
message of the plurality of e-mail messages is above a threshold (Fig. 3; para. 
[0023]), the taking remedial action including rejecting the e-mail message (Fig. 2, 
Step 60). 

It would have been obvious to one of ordinary skill in the art at the time of 
applicant's invention to generate a suspicion score as taught by Bandini in order 
to classify messages as either clean, borderline, or SPAM using a weighted 
system. 

64. Regarding claim 21 , Pace-Schiavone-Bandini teaches the invention 
substantially as claimed and described in claim 20, including that rejecting occurs 
before the e-mail message is completely received (Schiavone: para. [0026]). 

65. Claim 29 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pace as applied to claim 28 above, and further in view of Bates. 

66. Regarding claim 29, Pace teaches the invention substantially as claimed 
and described in claim 28 above, but fails to teach determining that an email 
message is potentially unwanted when the main text matches a substantially 
higher number of emails than the header hash. In other words, an email is 
unwanted when the same message is received from different addresses. 

Bates teaches determining that a message is unwanted when the same 
message is received from different senders (Col. 1 , lines 22-30). It would have 
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been obvious to one of ordinary skill in the art at the time of applicant's invention 
to determine messages to be unwanted when the same message is received 
from different senders as taught by Bates in order to avoid duplicate messages. 

Conclusion 

67. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 



a. 


U.S. 


Pub. No. 2002/0181703 


b. 


U.S. 


Pat. No. 5,946,679 


c. 


U.S. 


Pub. No. 2003/0236845 


d. 


U.S. 


Pat. No. 6,615,242 


e. 


U.S. 


Pat. No. 6,321,267 


f. 


U.S. 


Pat. No. 6,691,156 



Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to JULIAN CHANG whose telephone number is 
(571)272-8631 . The examiner can normally be reached on Monday thru Friday 
9AM to 5PM. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, John Follansbee can be reached on (571) 272-3964. The 
fax phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786- 
9199 (IN USA OR CANADA) or 571-272-1000. 

/J. C.I 

Examiner, Art Unit 2452 
/John Follansbee/ 

Supervisory Patent Examiner, Art Unit 2451 



